SEO: SSL Certificate Expired. Google Hasn’t Forgiven Me Yet.

Most website owners know an expired SSL certificate is bad. Few realise how bad. In late summer, the certificate on my site quietly expired, and I didn’t notice for about two weeks. The site itself was fine: content, server, and hosting were all untouched. But visitors got a full-screen browser warning telling them the site might be unsafe.

Fixing the certificate took minutes. Recovering from what happened next is taking much longer. Here’s what I found while digging through Google Search Console, and what I’d tell anyone in the same situation.

The drop

For months, my site had steady traffic from Google: roughly 50 to 100 clicks and around 5,000 impressions a day, mostly from a handful of in-depth guides and software reviews.

The certificate expired at the end of August. It wasn’t correctly renewed. Probably an error of the shared hosting / Direct Admin / Let’s Encrypt. Strangely, nothing happened at first. Clicks stayed normal for about a week. Then, overnight, impressions fell by about 95% and clicks went to almost zero. The certificate was renewed about a week after that. Two weeks later, the line in Search Console is still flat.

This SSL expiration also happened with another site, but for this site it only was expired for a few days. Result: the site restored and traffic is almost back at normal.

What I checked, and what it ruled out

When traffic collapses, it’s tempting to guess. I tried to work through it systematically instead.

Crawling. Search Console’s Crawl Stats showed Googlebot never stopped visiting the site. Crawl requests continued throughout, with a few large spikes, which is typical of Google retrying when it runs into problems. Failed requests were essentially zero, apart from one small blip around the time the certificate was replaced.

Indexing. URL Inspection showed my pages were all still indexed. A site: search confirmed it: every important page was still in Google’s index.

Rankings versus visibility. This was the most revealing check. With impressions and average position both switched on in the Performance report, I could see that impressions collapsed while the average position of the few remaining impressions actually improved. Google hadn’t pushed my pages down a few spots. It had simply stopped showing them for almost everything except searches for my brand.

The own-title test. Searching the exact title of my best-performing article in quotes showed it at the top. Without quotes, it didn’t appear on the first page at all, while other sites with near-identical titles did. When a page can’t rank for its own title, the problem isn’t that specific page. It’s the site as a whole.

Manual actions and security. Both reports in Search Console were clean. No penalty, no detected hack.

The key clue. One of my top pages had last been crawled before the certificate expired. Google never saw an error on that page, yet it disappeared from results on the same day as everything else. That told me Google wasn’t judging pages one by one. Something had changed at the site level.

Why a broken site can hurt long after it’s fixed

My working theory is that the outage prompted Google to reassess the whole site, and the site didn’t come out of that reassessment well.

There are a few ways this can happen, and they apply just as much to sites that were hacked and restored:

• Reliability signals. For a period, the site was returning security errors. Google may treat a host that suddenly looks broken or unsafe with caution, even after it’s fixed.
• User behavior. During the outage, many people clicked my results, saw a security warning, and hit the back button immediately. Google has acknowledged in court testimony that it learns from how users interact with search results. Whether that specific “bounce back” pattern contributed is impossible to prove from the outside, but it’s a plausible part of the picture, and it’s the same pattern hacked sites often produce.
• A second look at quality. A reassessment is also a moment where a site’s broader quality gets weighed again. If the site was already borderline, that can be enough to tip it over.

This is why restored hacked sites often don’t bounce back immediately either. Removing the malware or renewing the certificate fixes the cause, but it doesn’t instantly undo the assessment.

What recovery actually looks like

If your pages are indexed but invisible, and there’s no manual action, you’re likely dealing with a site-level algorithmic assessment. A few hard truths:

• It doesn’t lift gradually. These assessments usually change when Google reevaluates sites, often around a core update. That can take months.
• Fixing the technical issue is necessary but not sufficient. The certificate being fixed is the starting line, not the finish.
• Quality work is what shifts the odds. In my case, that means merging several overlapping articles into one strong guide, adding genuine first-hand experience and screenshots to reviews, making authorship and site ownership clear, and removing thin or duplicate pages, including archive pages that shouldn’t be indexed.

I’m doing this steadily rather than all at once, so I can keep track of what changed. And I’ve stopped checking the chart every day.

Lessons for other site owners

1. Automate certificate renewal, and monitor it. Use auto-renewing certificates and a simple uptime or SSL expiry monitor that emails you. This whole situation was avoidable with a five-minute setup.
2. Make sure your certificate covers every hostname, including the www version, and that redirects go straight to your preferred version.
3. When traffic drops, check impressions and position, not just clicks. They tell completely different stories.
4. Test whether your page ranks for its own title. It’s the quickest way to tell a page-level issue from a site-level one.
5. Don’t rely on a single traffic source. A newsletter, a community, or direct partnerships would have softened this blow considerably.

I’ll post an update once the next core update has rolled out. With any luck, it’ll be a recovery story.

Last Updated on 29 September 2026